from the really-winning-fans-here dept

Earlier this week, we wrote about the DOJ filing an indictment against some Chinese hackers who are a part of the People's Liberation Army. We found the situation rather ironic, given all that the NSA has been accused of on the cyberespionage front these days. We also found the whole thing to be incredibly counterproductive as it wouldn't do a damn thing to stop Chinese hacking, but would likely lead to other countries filing criminal charges against NSA hackers.

What was particularly crazy was the DOJ's smug announcement about how it finally had "proof" of Chinese hacks, naming some specific companies which had been hacked. In theory, the DOJ thinks it's helping to protect those businesses, but the reality may be the opposite. It appears that the DOJ may have just created a massive headache for those companies, as they may be facing probes and possible shareholder lawsuits about failures to disclose the hacks to investors. It's not entirely clear they needed to do so -- and the companies insist they revealed all material information -- but from the article, it's clear that class action lawyers will eat this one up and file expensive and wasteful lawsuits.

“The question is would an investor have cared if Chinese hackers broke into a company and were messing around the place?” Jacob Olcott, a principal focusing on cybersecurity at Good Harbor Security Risk Management LLC in Washington, said in a phone interview. “As an investor, show me the evidence that you reviewed this thoroughly.”

So, not only did these companies -- Alcoa and Allegheny Technologies Inc. -- get hacked in a way where it's unlikely that any criminal charges will catch the folks who did the hacking, those same companies may face another legal headache over the failure to reveal they got hacked by the Chinese. So exactly whom is the DOJ helping here?

from the questions,-question dept

There have been an awful lot of stories of computer hacks and breaches lately, many of them high profile: Google, Citibank, Sony, the US Senate. It certainly feels like everyone's under attack. But is that really true? Bruce Schneier suggests that it's just a media sensation:

"I truly don't think there's a higher instance of hacking right now. I think there's been a wave of media coverage," said Bruce Schneier, chief security technology officer of BT and one of the most respected security experts around. "We saw the same thing with shark attacks. It's not that there are more shark attacks. It's that they made the news when people started looking for them."

It does make me wonder. The media can be quite efficient at finding evidence of an epidemic when things are actually occurring at a normal rate, but it certainly does sound like some of the attacks lately are landing on bigger name targets. Part of this may also be the more public attacks from groups like Anonymous and Lulz Security, who are doing what they do more for publicity reasons than as criminal enterprises. Either way, I'm curious to see what others think about the issue. Are we really seeing more attacks and breaches today, or is the press just picking up on it lately?

from the big-questions dept

Privacy is an interesting issue -- where a lot of people have opinions on it that don't match up with either how they act or with what the law actually says. People say privacy is important to them, but then are very open about private things, even to the point of giving out all sorts of private info if someone gives them anything (chocolate, a pen, nothing at all). Yet, at the same time, if you talk to people about privacy, they talk about how important it is, and make silly demands about privacy policies, even though no one actually reads the policies, and assume (incorrectly) that if a site has any privacy policy, it means they'll keep the data completely private.

And, of course, we see privacy breaches on an all too regular basis. They've become a lot more noticeable over the last few years, as new rules required disclosure, but there are still questions about what it means if a company breaches its privacy policy. The traditional recourse has been one free year of credit monitoring service (if the breach included info that could be used for identity fraud). However, there have been some lawsuits over the matter, and as Ethan Ackerman and Eric Goldman discuss, the courts have been very reluctant to reward any damages to those who were "victims" of privacy breaches if there's no clear monetary loss.

This leads to a series of interesting questions. Congress has considered at times creating privacy legislation that could potentially include statutory damages for privacy breaches (and there are a few ideas for such legislation floating around with lobbyists). The problem with this, though, is that in some cases breaches really are inevitable -- and including a monetary reward could clearly (as Goldman notes) "overcompensate the victim or overdeter the defendant." That could have pretty significant unintended consequences, including significantly limiting the availability of certain services as companies don't want to take on the potential liability. At the same time, without any chance of monetary damages, there's a question about leaving little in the way of incentives for companies to actually take privacy seriously.

There's something to be said for the fact that a privacy breach does have a negative reputational impact on the companies who violate people's privacy, but it's reaching a point of saturation, where so many people's private info has been breached so often, that many people don't even register who's involved each time the latest breach comes along. So, it's not clear that there's a really good answer here -- though, I'm sure some folks in the comments will have some strong opinions. Should there be monetary awards for privacy breaches? Should Congress create a privacy law?